Can I safely uninstall Ruby?

Question

I wish to remove non-critical packages to limit exposure to potential security vulnerabilities.

I never use Ruby.

Does removing Ruby will increase security or break other parts of the system ?

Answer 1

If your package manager installed Ruby to begin with, then something on your system needs it.

The easiest way to find out what needs it is to test an attempt to remove the package. For instance:

# yum remove ruby
...
================================================================================
 Package         Arch      Version                Repository               Size
================================================================================
Removing:
 ruby            x86_64    1.8.7.352-12.el6_4     @updates                1.8 M
Removing for dependencies:
 facter          x86_64    1:1.7.3-1.el6          @puppetlabs-products    235 k
 hiera           noarch    1.2.1-1.el6            @puppetlabs-products     46 k
 puppet          noarch    3.3.0-1.el6            @puppetlabs-products    3.5 M
 ruby-irb        x86_64    1.8.7.352-12.el6_4     @updates                1.0 M
 ruby-rdoc       x86_64    1.8.7.352-12.el6_4     @updates                1.3 M
 ruby-rgen       noarch    0.6.5-1.el6            @puppetlabs-deps        315 k
 rubygem-json    x86_64    1.5.5-1.el6            @puppetlabs-deps        989 k
 rubygems        noarch    1.3.7-1.el6            @base                   711 k

Transaction Summary
================================================================================
Remove        9 Package(s)

Installed size: 9.9 M
Is this ok [y/N]: n
Exiting on user Command

So on my system, I see that it's needed by puppet. Since I actually need puppet, I will not remove ruby.

Similarly on Debian-based systems:

# apt-get remove ruby
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libshadow-ruby1.8 irb1.8 libaugeas0 rdoc libruby ruby1.8 rdoc1.8
  libaugeas-ruby1.8 puppet-common libruby1.8 libopenssl-ruby1.8
  libreadline-ruby1.8 libreadline5 libopenssl-ruby augeas-lenses
  libxmlrpc-ruby
Use 'apt-get autoremove' to remove them.
The following packages will be REMOVED:
  facter puppet ruby
0 upgraded, 0 newly installed, 3 to remove and 48 not upgraded.
After this operation, 983kB disk space will be freed.
Do you want to continue [Y/n]? n
Abort.

Answer 2

Removing ruby, on its own, isn't going to have much impact on security. If you aren't using it, how is an attacker going to exploit something in it? They would have to have a shell and be able to invoke the ruby interpreter, and if they have a shell there are a billion and one better ways for them to use it than running ruby (for what, to get a shell they already have?).

If you happen to have any SUID executables with ruby as their interpreter, that might give you security trouble (depending), or if ruby is in sudoers and the hypothetical attacker could run it that way (don't let anyone sudo an interpreter unless you are comfortable giving them root; don't ever let service accounts sudo interpreters), that would be a security issue. However, the security hole wouldn't result from ruby being installed, but from misconfiguration of your system in general.

Your approach is wrong. Remove unnecessary services, not unnecessary packages.

Answer 3

On RHEL based system you can use yum-utils package

# rpm -q --whatrequires ruby

Also useful command

# yum install yum-utils
# package-cleanup --leaves

On debian based system

# apt-cache showpkg ruby**